1

For some reasons, our Internet provider has a limitation on the number of simultaneous opened connections between the machines hosted in our private network and the Internet which is around 4000 simultaneous connections. (For the details, their limitation comes from the number of NAT sessions allowed at the same time).

We have no access on the Internet provider router, nor on the status of this limitation or how close we are of the maximum limit, but when the limited is reached, basically the internal machines have a very slow Internet access (if it works at all) and we have to spend hours with the hotline of the provider to convince them to reinitialize the table.

I would like to set up the same kind of limitation but on our side, so we can keep on eye on how it evolves, enforce smaller limits so we don't have to call them anymore and hopefully keep the connection smooth for everybody.

I have at hand a Linux machine configured as a bridge (with 2 network interface) and/or a RouterOS 6 router located between our internal private network and the router provided by our Internet provider (both are optional, I was just trying to see what would be the most convenient to configure in the time I had):

                         INTERNET
                            ^
                            |
                            |
                    +-------+------+
                    | Cisco Router |
                    +-------+------+
                            |
                            |
                            |
                      +-----+----+
                      | RouterOS |
                      +-----+----+
                            |
                            |
                            |
                    +-------+------+
                    | Linux Bridge |
                    +-------+------+
    +------------+----^     ^    ^-----+-------------+
    |            |          |          |             |
+---+---+   +----+--+   +---+---+   +--+----+   +----+--+
| Clt 1 |   | Clt 2 |   | Clt 3 |   | Clt 4 |   | Clt 5 |
+-------+   +-------+   +-------+   +-------+   +-------+

(we have at the moment 60+ "clients", which are computers, IP phones, servers, virtual machines, etc.)

It's easy to find documentation on how to limit the traffic bandwidth or connections on a server using iptables or tc but I can't find much things about the number of simultaneous connections. As far as I understand, that would be to take control of the conntrack-ing system of the bridge or our internal router and prevents new connections if we reach the limits but I can't find any information on how to do that.

I would be interested to have some pointers for a Linux solution, which I can try to convert to RouterOS, as it might be more generally applicable to other configurations.

For extra details:

  • the internal network is within the 192.168.101.0/24 sub-network
  • both the bridge and the RouterOS router machines have a IP address from this sub-network
  • the Internet provider router is running a DHCP server and its private IP address (192.168.101.254) is configured as the default route towards the Internet
  • the only things we can do with the Internet provider router is to reboot it and shuffle the network cables around :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.